The system disclosed in Patent Literature 1 is an example of an operation detecting system for detecting either a malicious or a suspicious operation. In the technology described in Patent Literature 1, an administrator (user), after creating an illegal operation pattern beforehand and registering same in a database of a log analysis server, determines risk in accordance with the degree of matching with the contents of a pre-registered user operation log.